SAML/ADFS Abuse to Reach Cloud Resources

Jim talks with Paul Volosen, Information Security Architect & Vice President at Mitsubishi UFJ Financial Group, about the recent SolarWinds breach.

Show Links:

Connect with Paul on LinkedIn: https://www.linkedin.com/in/paulvolosen/

Paul's CyberSecurity 101 on LinkedIn:

https://www.linkedin.com/feed/update/urn:li:activity:6733870238582108160/

SolarWinds Brief: https://www.solarwinds.com/securityadvisory/faq

NSA Brief: https://media.defense.gov/2020/Dec/17/2002554125/-1/-1/0/AUTHENTICATION_MECHANISMS_CSA_U_OO_198854_20.PDF?mkt_tok=eyJpIjoiWTJFNU9UazRZV0l3WVdZNCIsInQiOiJyU0dmeTJ1U3hWTmFIMThIV3F2b1BiTWE3SndIZXBDNGNlakU3VWQxNnpDNzA1TWVLXC9QWEFGbkFsM1YxNzFPUzF2TjNhSGZ2NTY1TlcrVUM0Zm43Z1FMN3d2VHNkb2VyeWtlWWw2dkQ4SXNka3VqM0IrU01cLzh6MzdKRUVwVG50In0%3D

DHS Brief: https://cyber.dhs.gov/ed/21-01/

FireEye Brief: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

Microsoft Brief: https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

Microsoft 365 Security Recommendations: https://techcommunity.microsoft.com/t5/azure-active-directory-identity/protecting-microsoft-365-from-on-premises-attacks/ba-p/1751754

Connect with Jim and Jeff on LinkedIn here:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show at www.IdentityAtTheCenter.comand follow @IDACPodcast on Twitter.